windows-development-sandbox 1.5.0 → 1.9.0

package/dist/shared/vpn/ovpn.js

@@ -0,0 +1,244 @@
+// An OpenVPN profile (.ovpn) is untrusted data: it comes from the internet or from a file you were given, and OpenVPN
+// can run programs from it (script-security, up, down, plugin ...) with administrator rights. Only directives on a
+// short list of harmless ones are accepted; anything else is refused by name. Also answers where the tunnel connects
+// (the `remote` lines), which the kill switch needs. Pure: no files, no network.
+/** Directives that run a program, load code or touch a file on this machine. Refused with a clear reason. */
+export const PROGRAM_DIRECTIVES = [
+    'script-security',
+    'up',
+    'down',
+    'up-restart',
+    'down-pre',
+    'route-up',
+    'route-pre-down',
+    'ipchange',
+    'tls-verify',
+    'plugin',
+    'client-connect',
+    'client-disconnect',
+    'learn-address',
+    'auth-user-pass-verify',
+    'setenv-safe',
+    'management',
+    'management-client',
+    'management-client-auth',
+    'management-hold',
+    'management-query-passwords',
+    'config',
+    'daemon',
+    'service',
+    'cd',
+    'chroot',
+    'setcon',
+    'log',
+    'log-append',
+    'writepid',
+    'status',
+    'askpass',
+    'engine',
+    'bcast-dev',
+    'dev-node',
+    'cryptoapicert',
+    'pkcs11-providers',
+    'pkcs12',
+    'http-proxy-user-pass',
+    'tmp-dir',
+];
+/** Directives that are only settings of the tunnel. Everything else is refused. */
+const ALLOWED = new Set([
+    'client',
+    'tls-client',
+    'dev',
+    'dev-type',
+    'proto',
+    'remote',
+    'remote-random',
+    'remote-random-hostname',
+    'resolv-retry',
+    'nobind',
+    'persist-key',
+    'persist-tun',
+    'remote-cert-tls',
+    'remote-cert-eku',
+    'ns-cert-type',
+    'verify-x509-name',
+    'cipher',
+    'data-ciphers',
+    'data-ciphers-fallback',
+    'ncp-ciphers',
+    'auth',
+    'verb',
+    'mute',
+    'mute-replay-warnings',
+    'reneg-sec',
+    'reneg-bytes',
+    'reneg-pkts',
+    'tun-mtu',
+    'tun-mtu-extra',
+    'ping-timer-rem',
+    'fast-io',
+    'tls-timeout',
+    'push-peer-info',
+    'comp-noadapt',
+    'link-mtu',
+    'fragment',
+    'mssfix',
+    'sndbuf',
+    'rcvbuf',
+    'comp-lzo',
+    'compress',
+    'allow-compression',
+    'key-direction',
+    'auth-user-pass',
+    'auth-nocache',
+    'explicit-exit-notify',
+    'pull',
+    'pull-filter',
+    'route-nopull',
+    'route',
+    'route-ipv6',
+    'route-delay',
+    'route-metric',
+    'redirect-gateway',
+    'redirect-private',
+    'dhcp-option',
+    'block-outside-dns',
+    'register-dns',
+    'topology',
+    'tls-version-min',
+    'tls-version-max',
+    'tls-cipher',
+    'tls-ciphersuites',
+    'tls-groups',
+    'tls-exit',
+    'ping',
+    'ping-restart',
+    'ping-exit',
+    'keepalive',
+    'connect-retry',
+    'connect-retry-max',
+    'connect-timeout',
+    'server-poll-timeout',
+    'float',
+    'ifconfig-nowarn',
+    'tun-ipv6',
+    'disable-dco',
+    'windows-driver',
+    'ignore-unknown-option',
+    'opt-verify',
+    'setenv',
+    'key-method',
+    'replay-window',
+    'hand-window',
+    'tran-window',
+    'inactive',
+    'socket-flags',
+    'auth-retry',
+    'ca',
+    'cert',
+    'key',
+    'tls-auth',
+    'tls-crypt',
+    'tls-crypt-v2',
+    'extra-certs',
+    'dh',
+]);
+/** Directives that name a file: only allowed as inline sections (the certificates must be inside the profile). */
+const FILE_DIRECTIVES = new Set(['ca', 'cert', 'key', 'tls-auth', 'tls-crypt', 'tls-crypt-v2', 'extra-certs', 'dh']);
+/** The inline sections (<ca> ... </ca>); their text is data, never parsed as directives. */
+const BLOCKS = new Set(['ca', 'cert', 'key', 'tls-auth', 'tls-crypt', 'tls-crypt-v2', 'extra-certs', 'dh']);
+export const MAX_OVPN_BYTES = 256 * 1024;
+const MAX_LINES = 4000;
+const HOST = /^(?:\d{1,3}(?:\.\d{1,3}){3}|[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?)$/;
+function directiveOf(line) {
+    const text = line.replace(/^\uFEFF/, '').trim();
+    if (text === '' || text.startsWith('#') || text.startsWith(';'))
+        return null;
+    // OpenVPN accepts "--client" too.
+    const parts = text.replace(/^-+/, '').split(/\s+/);
+    return { name: parts[0].toLowerCase(), args: parts.slice(1) };
+}
+/**
+ * Checks a profile. `ok: false` lists the problems; `ok: true` gives the servers it connects to. A profile must name at
+ * least one remote, and every certificate must be inside it.
+ */
+export function inspectOvpn(text) {
+    const problems = [];
+    const found = [];
+    const refuse = (message) => {
+        if (problems.length < 20 && !problems.includes(message))
+            problems.push(message);
+    };
+    if (Buffer.byteLength(text, 'utf8') > MAX_OVPN_BYTES)
+        return { ok: false, problems: ['the file is too big'] };
+    if (text.includes('\0'))
+        return { ok: false, problems: ['the file is not text'] };
+    const lines = text.split(/\r?\n/);
+    if (lines.length > MAX_LINES)
+        return { ok: false, problems: ['the file has too many lines'] };
+    let block = null;
+    let defaultProto = 'udp';
+    lines.forEach((line, i) => {
+        const at = 'line ' + (i + 1) + ': ';
+        const trimmed = line.trim();
+        if (block) {
+            if (trimmed.toLowerCase() === '</' + block + '>')
+                block = null;
+            else if (/^<\/?[A-Za-z-]+>$/.test(trimmed))
+                refuse(at + 'a section inside a section');
+            return;
+        }
+        const open = /^<([A-Za-z0-9-]+)>$/.exec(trimmed);
+        if (open) {
+            const tag = open[1].toLowerCase();
+            if (!BLOCKS.has(tag))
+                refuse(at + '<' + tag + '> is not allowed');
+            block = tag;
+            return;
+        }
+        const d = directiveOf(line);
+        if (!d)
+            return;
+        if (!/^[a-z0-9-]{1,40}$/.test(d.name))
+            return refuse(at + 'a directive name with odd characters');
+        if (PROGRAM_DIRECTIVES.includes(d.name))
+            return refuse(at + d.name + ' runs a program or reads or writes a file on this machine');
+        if (!ALLOWED.has(d.name))
+            return refuse(at + d.name + ' is not on the list of settings that are safe to accept');
+        if (FILE_DIRECTIVES.has(d.name))
+            return refuse(at + d.name + ' names a file: certificates must be inside the profile');
+        if (d.name === 'auth-user-pass' && d.args.length > 0)
+            return refuse(at + 'auth-user-pass names a file: the login is given separately');
+        if (d.name === 'setenv' && !(d.args[0] === 'CLIENT_CERT' && d.args.length === 2))
+            return refuse(at + 'setenv may only be CLIENT_CERT');
+        if (d.name === 'proto')
+            defaultProto = d.args[0]?.startsWith('tcp') ? 'tcp' : 'udp';
+        if (d.name === 'remote') {
+            const [host, port = '1194', proto] = d.args;
+            if (!host || !HOST.test(host))
+                return refuse(at + 'remote needs a host name or an IPv4 address');
+            const n = Number(port);
+            if (!Number.isInteger(n) || n < 1 || n > 65535)
+                return refuse(at + 'remote has an invalid port');
+            found.push({ host, port: n, ...(proto ? { proto: proto.startsWith('tcp') ? 'tcp' : 'udp' } : {}) });
+        }
+    });
+    // A remote without its own protocol uses the profile's proto line, wherever that line is.
+    const remotes = found.map((r) => ({ host: r.host, port: r.port, proto: r.proto ?? defaultProto }));
+    if (block)
+        refuse('a <' + block + '> section is never closed');
+    if (remotes.length === 0)
+        refuse('it names no remote server');
+    if (remotes.length > 64)
+        refuse('it names too many servers');
+    return problems.length ? { ok: false, problems } : { ok: true, remotes };
+}
+/** The servers of a safe profile; throws, saying why, when it is not (`what` names the file or source). */
+export function assertSafeOvpn(text, what) {
+    const report = inspectOvpn(text);
+    if (report.ok)
+        return report.remotes;
+    throw new Error(what +
+        ' was refused because it could run programs or is not a plain profile:\n  - ' +
+        report.problems.slice(0, 5).join('\n  - '));
+}

package/dist/shared/vpn/wireguard.d.ts

@@ -0,0 +1,51 @@
+export declare const MAX_WIREGUARD_BYTES: number;
+/** Keys that run a program, change the routes or write the config back. Refused with a clear reason. */
+export declare const WIREGUARD_PROGRAM_KEYS: readonly ["preup", "postup", "predown", "postdown", "table", "saveconfig"];
+export interface WireguardPeer {
+    readonly publicKey: string;
+    readonly presharedKey?: string;
+    readonly allowedIps: readonly string[];
+    readonly endpointHost: string;
+    readonly endpointPort: number;
+    readonly keepalive?: number;
+}
+/** A checked config. Holds secrets (privateKey, presharedKey): never log it or write it to session.json. */
+export interface WireguardConfig {
+    readonly privateKey: string;
+    readonly addresses: readonly string[];
+    readonly dns: readonly string[];
+    readonly mtu?: number;
+    readonly listenPort?: number;
+    readonly peers: readonly WireguardPeer[];
+}
+export type WireguardReport = {
+    readonly ok: true;
+    readonly config: WireguardConfig;
+} | {
+    readonly ok: false;
+    readonly problems: readonly string[];
+};
+/** Where the tunnel connects (the kill switch allows these, over udp). */
+export interface WireguardEndpoint {
+    readonly host: string;
+    readonly port: number;
+}
+/**
+ * Checks a config. `ok: false` lists the problems (no values in them); `ok: true` gives the checked settings. It needs
+ * one [Interface] with a PrivateKey and an IPv4 Address, and at least one [Peer] with PublicKey, AllowedIPs and an
+ * Endpoint that is a name or an IPv4 address (the kill switch rules are IPv4).
+ */
+export declare function inspectWireguard(text: string): WireguardReport;
+/** The checked config; throws, saying why (never with a key), when it is not safe. `what` names the file. */
+export declare function assertSafeWireguard(text: string, what: string): WireguardConfig;
+/** The config as text, written from the checked values. `endpointIps` puts an address in a peer's place. */
+export declare function renderWireguard(config: WireguardConfig, endpointIps?: Readonly<Record<number, string>>): string;
+export declare function wireguardEndpoints(config: WireguardConfig): WireguardEndpoint[];
+/** The tunnel's own IPv4 address (what the kill switch lets through once the tunnel is up). */
+export declare function wireguardTunnelAddress(config: WireguardConfig): string;
+/** True when some peer sends all IPv4 traffic through the tunnel (AllowedIPs 0.0.0.0/0). */
+export declare function routesEverything(config: WireguardConfig): boolean;
+/** Whether `sc query` output says the tunnel service is running. */
+export declare function serviceRunning(scOutput: string): boolean;
+/** Whether `wg show <tunnel> latest-handshakes` says a peer has completed a handshake (a time that is not 0). */
+export declare function handshakeDone(wgOutput: string): boolean;

package/dist/shared/vpn/wireguard.js

@@ -0,0 +1,227 @@
+// A WireGuard config (.conf) is untrusted data: it comes from a file you were given, and WireGuard for Windows runs the
+// programs of PreUp/PostUp/PreDown/PostDown with administrator rights. Only the settings on a short list are accepted;
+// anything else is refused by name, and the config that is handed on is written again from the checked values, never
+// copied. Problem messages name keys and lines, never values (the private and preshared keys are secrets). Also answers
+// where the tunnel connects and which address it has, which the kill switch needs. Pure: no files, no network.
+import net from 'node:net';
+export const MAX_WIREGUARD_BYTES = 16 * 1024;
+const MAX_LINES = 300;
+const MAX_PEERS = 16;
+/** Keys that run a program, change the routes or write the config back. Refused with a clear reason. */
+export const WIREGUARD_PROGRAM_KEYS = ['preup', 'postup', 'predown', 'postdown', 'table', 'saveconfig'];
+const INTERFACE_KEYS = new Set(['privatekey', 'address', 'dns', 'mtu', 'listenport']);
+const PEER_KEYS = new Set(['publickey', 'presharedkey', 'allowedips', 'endpoint', 'persistentkeepalive']);
+/** Keys that may be given more than once (their values are joined). */
+const LIST_KEYS = new Set(['address', 'dns', 'allowedips']);
+const KEY = /^[A-Za-z0-9+/]{43}=$/;
+const HOST = /^(?:\d{1,3}(?:\.\d{1,3}){3}|[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?)$/;
+function validCidr(text) {
+    const [addr, prefix, ...rest] = text.split('/');
+    if (rest.length > 0 || !addr)
+        return false;
+    const version = net.isIP(addr);
+    if (version === 0)
+        return false;
+    if (prefix === undefined)
+        return true;
+    if (!/^\d{1,3}$/.test(prefix))
+        return false;
+    return Number(prefix) <= (version === 4 ? 32 : 128);
+}
+const inRange = (text, low, high) => {
+    if (!/^\d{1,5}$/.test(text))
+        return null;
+    const n = Number(text);
+    return n >= low && n <= high ? n : null;
+};
+const splitList = (text) => text
+    .split(',')
+    .map((s) => s.trim())
+    .filter(Boolean);
+/**
+ * Checks a config. `ok: false` lists the problems (no values in them); `ok: true` gives the checked settings. It needs
+ * one [Interface] with a PrivateKey and an IPv4 Address, and at least one [Peer] with PublicKey, AllowedIPs and an
+ * Endpoint that is a name or an IPv4 address (the kill switch rules are IPv4).
+ */
+export function inspectWireguard(text) {
+    const problems = [];
+    const refuse = (message) => {
+        if (problems.length < 20 && !problems.includes(message))
+            problems.push(message);
+    };
+    if (Buffer.byteLength(text, 'utf8') > MAX_WIREGUARD_BYTES)
+        return { ok: false, problems: ['the file is too big'] };
+    if (text.includes('\0'))
+        return { ok: false, problems: ['the file is not text'] };
+    const lines = (text.charCodeAt(0) === 0xfeff ? text.slice(1) : text).split(/\r?\n/);
+    if (lines.length > MAX_LINES)
+        return { ok: false, problems: ['the file has too many lines'] };
+    const sections = [];
+    let current = null;
+    lines.forEach((raw, i) => {
+        const at = 'line ' + (i + 1) + ': ';
+        const line = raw.replace(/#.*$/, '').trim();
+        if (!line)
+            return;
+        const header = /^\[([A-Za-z]{1,20})\]$/.exec(line);
+        if (header) {
+            const name = header[1].toLowerCase();
+            if (name !== 'interface' && name !== 'peer') {
+                current = null;
+                return refuse(at + '[' + name + '] is not allowed');
+            }
+            current = { kind: name, values: new Map() };
+            sections.push(current);
+            return;
+        }
+        const pair = /^([A-Za-z]{1,40})\s*=\s*(.*)$/.exec(line);
+        if (!pair)
+            return refuse(at + 'not a "Key = value" line');
+        const key = pair[1].toLowerCase();
+        if (WIREGUARD_PROGRAM_KEYS.includes(key))
+            return refuse(at + pair[1] + ' runs a program or changes how the tunnel is routed or saved');
+        if (!current)
+            return refuse(at + pair[1] + ' is outside a section');
+        if (!(current.kind === 'interface' ? INTERFACE_KEYS : PEER_KEYS).has(key))
+            return refuse(at + pair[1] + ' is not on the list of settings that are safe to accept');
+        const seen = current.values.get(key);
+        if (seen && !LIST_KEYS.has(key))
+            return refuse(at + pair[1] + ' is given twice');
+        current.values.set(key, [...(seen ?? []), pair[2].trim()]);
+    });
+    const one = (s, key) => s.values.get(key)?.[0];
+    const joined = (s, key) => (s.values.get(key) ?? []).flatMap(splitList);
+    const interfaces = sections.filter((s) => s.kind === 'interface');
+    const peers = sections.filter((s) => s.kind === 'peer');
+    if (interfaces.length !== 1)
+        refuse('it needs exactly one [Interface] section');
+    if (peers.length === 0)
+        refuse('it has no [Peer] section');
+    if (peers.length > MAX_PEERS)
+        refuse('it has too many [Peer] sections');
+    if (problems.length)
+        return { ok: false, problems };
+    const face = interfaces[0];
+    const privateKey = one(face, 'privatekey');
+    if (!privateKey)
+        refuse('[Interface] has no PrivateKey');
+    else if (!KEY.test(privateKey))
+        refuse('PrivateKey is not a WireGuard key (44 characters of base64)');
+    const addresses = joined(face, 'address');
+    if (addresses.length === 0 || !addresses.every(validCidr))
+        refuse('[Interface] needs valid Address values');
+    else if (!addresses.some((a) => net.isIPv4(a.split('/')[0])))
+        refuse('Address needs an IPv4 address (the kill switch works on IPv4)');
+    const dns = joined(face, 'dns');
+    if (!dns.every((d) => net.isIP(d) !== 0))
+        refuse('DNS may only list IP addresses');
+    const mtuText = one(face, 'mtu');
+    const mtu = mtuText === undefined ? undefined : inRange(mtuText, 576, 1500);
+    if (mtuText !== undefined && mtu === null)
+        refuse('MTU must be a number from 576 to 1500');
+    const portText = one(face, 'listenport');
+    const listenPort = portText === undefined ? undefined : inRange(portText, 1, 65535);
+    if (portText !== undefined && listenPort === null)
+        refuse('ListenPort must be a number from 1 to 65535');
+    const checked = [];
+    peers.forEach((p, n) => {
+        const who = '[Peer] ' + (n + 1) + ': ';
+        const publicKey = one(p, 'publickey');
+        if (!publicKey || !KEY.test(publicKey))
+            return refuse(who + 'PublicKey is missing or not a WireGuard key');
+        const preshared = one(p, 'presharedkey');
+        if (preshared !== undefined && !KEY.test(preshared))
+            return refuse(who + 'PresharedKey is not a WireGuard key');
+        const allowed = joined(p, 'allowedips');
+        if (allowed.length === 0 || !allowed.every(validCidr))
+            return refuse(who + 'AllowedIPs is missing or invalid');
+        const endpoint = one(p, 'endpoint');
+        const m = endpoint ? /^([^:[\]]+):(\d{1,5})$/.exec(endpoint) : null;
+        if (!m || !HOST.test(m[1]) || inRange(m[2], 1, 65535) === null)
+            return refuse(who + 'Endpoint must be host:port with a name or an IPv4 address');
+        if (/^\d+\.\d+\.\d+\.\d+$/.test(m[1]) && !net.isIPv4(m[1]))
+            return refuse(who + 'Endpoint is not a valid address');
+        const keepText = one(p, 'persistentkeepalive');
+        let keepalive;
+        if (keepText !== undefined && keepText.toLowerCase() !== 'off') {
+            const k = inRange(keepText, 0, 65535);
+            if (k === null)
+                return refuse(who + 'PersistentKeepalive must be a number or off');
+            keepalive = k;
+        }
+        checked.push({
+            publicKey,
+            ...(preshared ? { presharedKey: preshared } : {}),
+            allowedIps: allowed,
+            endpointHost: m[1],
+            endpointPort: Number(m[2]),
+            ...(keepalive !== undefined ? { keepalive } : {}),
+        });
+    });
+    if (problems.length || !privateKey)
+        return { ok: false, problems };
+    return {
+        ok: true,
+        config: {
+            privateKey,
+            addresses,
+            dns,
+            ...(typeof mtu === 'number' ? { mtu } : {}),
+            ...(typeof listenPort === 'number' ? { listenPort } : {}),
+            peers: checked,
+        },
+    };
+}
+/** The checked config; throws, saying why (never with a key), when it is not safe. `what` names the file. */
+export function assertSafeWireguard(text, what) {
+    const report = inspectWireguard(text);
+    if (report.ok)
+        return report.config;
+    throw new Error(what +
+        ' was refused because it could run programs or is not a plain WireGuard config:\n  - ' +
+        report.problems.slice(0, 5).join('\n  - '));
+}
+/** The config as text, written from the checked values. `endpointIps` puts an address in a peer's place. */
+export function renderWireguard(config, endpointIps = {}) {
+    const out = ['[Interface]', 'PrivateKey = ' + config.privateKey, 'Address = ' + config.addresses.join(', ')];
+    if (config.dns.length)
+        out.push('DNS = ' + config.dns.join(', '));
+    if (config.mtu !== undefined)
+        out.push('MTU = ' + config.mtu);
+    if (config.listenPort !== undefined)
+        out.push('ListenPort = ' + config.listenPort);
+    config.peers.forEach((p, i) => {
+        out.push('', '[Peer]', 'PublicKey = ' + p.publicKey);
+        if (p.presharedKey)
+            out.push('PresharedKey = ' + p.presharedKey);
+        out.push('AllowedIPs = ' + p.allowedIps.join(', '), 'Endpoint = ' + (endpointIps[i] ?? p.endpointHost) + ':' + p.endpointPort);
+        if (p.keepalive !== undefined)
+            out.push('PersistentKeepalive = ' + p.keepalive);
+    });
+    return out.join('\r\n') + '\r\n';
+}
+export function wireguardEndpoints(config) {
+    return config.peers.map((p) => ({ host: p.endpointHost, port: p.endpointPort }));
+}
+/** The tunnel's own IPv4 address (what the kill switch lets through once the tunnel is up). */
+export function wireguardTunnelAddress(config) {
+    const found = config.addresses.map((a) => a.split('/')[0]).find((a) => net.isIPv4(a));
+    if (!found)
+        throw new Error('the config has no IPv4 address');
+    return found;
+}
+/** True when some peer sends all IPv4 traffic through the tunnel (AllowedIPs 0.0.0.0/0). */
+export function routesEverything(config) {
+    return config.peers.some((p) => p.allowedIps.some((a) => a === '0.0.0.0/0'));
+}
+/** Whether `sc query` output says the tunnel service is running. */
+export function serviceRunning(scOutput) {
+    return /STATE\s*:\s*\d+\s+RUNNING/i.test(scOutput);
+}
+/** Whether `wg show <tunnel> latest-handshakes` says a peer has completed a handshake (a time that is not 0). */
+export function handshakeDone(wgOutput) {
+    return wgOutput.split(/\r?\n/).some((line) => {
+        const t = /\s(\d+)\s*$/.exec(line);
+        return t !== null && Number(t[1]) > 0;
+    });
+}

package/dist/shared/web/index.d.ts

@@ -0,0 +1 @@
+export * from './protocol.js';

package/dist/shared/web/index.js

@@ -0,0 +1 @@
+export * from './protocol.js';

package/dist/shared/web/protocol.d.ts

@@ -0,0 +1,61 @@
+/** The header every state-changing call carries (a browser page of another site cannot add it without CORS). */
+export declare const CSRF_HEADER = "x-sandbox-web";
+export declare const CSRF_VALUE = "1";
+export declare const COOKIE_NAME = "sbxweb";
+export interface WebSession {
+    readonly id: string;
+    readonly harness: string;
+    readonly project: string;
+    readonly cwd: string;
+    readonly phase: 'starting' | 'running' | 'exited' | 'failed';
+    readonly message: string;
+    readonly startedAt: string;
+    /** Terminals attached right now (null: the session could not be asked). */
+    readonly viewers: number | null;
+    /** The session can be opened here (running, and reachable from this PC). */
+    readonly canOpen: boolean;
+}
+export interface WebProject {
+    readonly name: string;
+    readonly guest: string;
+}
+export interface WebInfo {
+    readonly sandbox: 'running' | 'stopped';
+    /** "Running, started by alice (shared with you)" and the like; null for your own sandbox. */
+    readonly owner: string | null;
+    /** This user may open sessions and start new ones in the running sandbox. */
+    readonly canUse: boolean;
+    readonly harnesses: readonly string[];
+    readonly defaultHarness: string;
+    readonly projects: readonly WebProject[];
+}
+export interface NewSessionRequest {
+    readonly harness: string;
+    readonly project: string;
+}
+/** Browser -> server on the terminal socket: binary messages are keystrokes; text messages are these (JSON). */
+export type ClientMessage = {
+    readonly t: 'resize';
+    readonly cols: number;
+    readonly rows: number;
+};
+/** Server -> browser: binary messages are terminal output; text messages are these (JSON). */
+export type ServerMessage = {
+    readonly t: 'ready';
+} | {
+    readonly t: 'restarting';
+} | {
+    readonly t: 'exit';
+    readonly code: number;
+} | {
+    readonly t: 'error';
+    readonly message: string;
+};
+export declare const MIN_COLS = 10;
+export declare const MAX_COLS = 500;
+export declare const MIN_ROWS = 2;
+export declare const MAX_ROWS = 300;
+/** Biggest browser message the server accepts (a paste); more closes the socket. */
+export declare const MAX_CLIENT_MESSAGE_BYTES: number;
+/** A browser message that is JSON of a known shape and sane numbers, else null (the socket is then closed). */
+export declare function parseClientMessage(text: string): ClientMessage | null;

package/dist/shared/web/protocol.js

@@ -0,0 +1,35 @@
+// What the web UI's server and its browser app say to each other. Types and constants only (no Node, no DOM), so the
+// server (src/host/web) and the app (web/) share one definition.
+/** The header every state-changing call carries (a browser page of another site cannot add it without CORS). */
+export const CSRF_HEADER = 'x-sandbox-web';
+export const CSRF_VALUE = '1';
+export const COOKIE_NAME = 'sbxweb';
+export const MIN_COLS = 10;
+export const MAX_COLS = 500;
+export const MIN_ROWS = 2;
+export const MAX_ROWS = 300;
+/** Biggest browser message the server accepts (a paste); more closes the socket. */
+export const MAX_CLIENT_MESSAGE_BYTES = 256 * 1024;
+/** A browser message that is JSON of a known shape and sane numbers, else null (the socket is then closed). */
+export function parseClientMessage(text) {
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    if (typeof value !== 'object' || value === null)
+        return null;
+    const m = value;
+    if (m.t !== 'resize')
+        return null;
+    const { cols, rows } = m;
+    if (!Number.isInteger(cols) || !Number.isInteger(rows))
+        return null;
+    const c = cols;
+    const r = rows;
+    if (c < MIN_COLS || c > MAX_COLS || r < MIN_ROWS || r > MAX_ROWS)
+        return null;
+    return { t: 'resize', cols: c, rows: r };
+}

package/dist/sync/sync-cycle.js

@@ -1,14 +1,15 @@
 import path from 'node:path';
 import { assertNoLinks } from '../core/util/index.js';
-import { hostClaudeDir } from '../host/profile/index.js';
+import { hostClaudeDir, PluginShare } from '../host/profile/index.js';
+import { hostDataFolder, hostDataRoot, storageOf } from '../host/storage/index.js';
 import { hostClaudeMemDir, syncClaudeMem } from './claude-mem.js';
 import { readSyncState, writeSyncState } from './sync-state.js';
 import { syncHistoryIn, syncHistoryOut } from './history.js';
-const guestClaude = (dataPath) => path.join(dataPath, 'state', 'claude');
-const guestMem = (dataPath) => path.join(dataPath, 'state', 'claude-mem');
+const guestClaude = (dataPath) => path.join(hostDataFolder(dataPath, 'state'), 'claude');
+const guestMem = (dataPath) => path.join(hostDataFolder(dataPath, 'state'), 'claude-mem');
 /** Sync paths for the sandbox side, after checking nothing on the way there is a link planted by the sandbox. */
 const toPaths = (state, dataPath) => {
-    assertNoLinks(dataPath, guestClaude(dataPath));
+    assertNoLinks(hostDataRoot(dataPath), guestClaude(dataPath));
     return {
         hostClaudeDir: state.hostClaudeDir,
         guestClaudeDir: guestClaude(dataPath),
@@ -37,7 +38,7 @@ export function syncProjectIn(dataPath, project) {
         : 0;
 }
 const memSync = (dataPath, state, direction) => {
-    assertNoLinks(dataPath, guestMem(dataPath));
+    assertNoLinks(hostDataRoot(dataPath), guestMem(dataPath));
     return syncClaudeMem(hostClaudeMemDir(), guestMem(dataPath), state, direction);
 };
 /** Before launch: finish syncing the previous run out, then bring this PC's history (and claude-mem) in. */
@@ -58,6 +59,7 @@ export function syncBeforeLaunch(config, dataPath, hostWorkspace) {
         historyScope: profile.historyScope,
         syncClaudeMem: profile.syncClaudeMem,
         syncClaudeMemBack: profile.syncClaudeMemBack,
+        sharePlugins: profile.sharePluginsAcrossAccounts,
         projects: [],
     };
     if (profile.syncHistory)
@@ -78,6 +80,8 @@ export function syncBack(dataPath, final) {
         return summary;
     if (state.syncHistory)
         summary.history = syncHistoryOut(toPaths(state, dataPath));
+    if (final && state.sharePlugins)
+        PluginShare.in(storageOf(dataPath)).saveQuietly(dataPath, guestClaude(dataPath));
     if (final && state.syncClaudeMem && state.syncClaudeMemBack)
         summary.claudeMem = memSync(dataPath, state, 'out');
     writeSyncState(dataPath, state);